honeycrawlpot
A zero-dependency open-source honeypot middleware mounted behind real routes and before the 404 handler. It returns fabricated plausible files (fake keys, fake configurations, prompt injections) for known scanning paths, trapping automated scanners and actively detecting attacks through canary tokens.
Timeline (last 90 days)
honeycrawlpot is a zero-dependency honeypot middleware that sits after real routes and before the 404 handler, returning HTTP 200 and plausible-looking fake files when a request hits a known scanner path.
In the two web frameworks Hono and Express, the honeypot middleware must be registered after real routes and before the 404 handler; otherwise it either hits legitimate traffic or the scanner paths get swallowed by the fallback logic and never reach the honeypot.
honeycrawlpot provides ready-made adapters for Hono and Express.
Configuring deny all and returning 403 for scanner paths on Nginx reveals that these paths exist and are protected; a better approach is to reverse-proxy these paths to the application and let the honeypot respond, while excluding real SPA routes such as /admin and /dashboard from the scanner regex.
honeycrawlpot's createHoneypot supports configuring the brand name, deployment version, internal domains (such as pgbouncer, redis, minio), and custom injection instructions via extraInjections to tailor the decoy content.
Each honeycrawlpot deployment can be configured with a unique canary token (such as LF-HONEYPOT-QONTO-01) that appears in the fake files and can be used to monitor in logs, SIEM, or scanner reports whether anyone has triggered the honeypot.
All Facts (6)
honeycrawlpot is a zero-dependency honeypot middleware that sits after real routes and before the 404 handler, returning HTTP 200 and plausible-looking fake files when a request hits a known scanner path.
50%UnverifiedIn the two web frameworks Hono and Express, the honeypot middleware must be registered after real routes and before the 404 handler; otherwise it either hits legitimate traffic or the scanner paths get swallowed by the fallback logic and never reach the honeypot.
50%Unverifiedhoneycrawlpot provides ready-made adapters for Hono and Express.
50%UnverifiedConfiguring deny all and returning 403 for scanner paths on Nginx reveals that these paths exist and are protected; a better approach is to reverse-proxy these paths to the application and let the honeypot respond, while excluding real SPA routes such as /admin and /dashboard from the scanner regex.
50%Unverifiedhoneycrawlpot's createHoneypot supports configuring the brand name, deployment version, internal domains (such as pgbouncer, redis, minio), and custom injection instructions via extraInjections to tailor the decoy content.
50%UnverifiedEach honeycrawlpot deployment can be configured with a unique canary token (such as LF-HONEYPOT-QONTO-01) that appears in the fake files and can be used to monitor in logs, SIEM, or scanner reports whether anyone has triggered the honeypot.
50%